Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-02-2015 Ran by Aniut at 2015-02-04 14:22:53 Run:2 Running from C:\Users\Aniut\Desktop Loaded Profiles: Aniut (Available profiles: Aniut) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: HKLM-x32\...\Run: [] => [X] HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\...\Run: [AVG-Secure-Search-Update_0913b] => C:\Users\Aniut\AppData\Roaming\AVG 0913b Campaign\AVG-Secure-Search-Update-0913b.exe /PROMPT --mid d7d99be1fdb047d3b0af416272bd952b-7b84e138c2dd6d732339f8a915c00ffe944619fe --CMPID 0913b HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\...\Run: [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA] => 1 HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Toolbar: HKU\S-1-5-21-4088076161-2145778700-1263544819-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File Task: {B992F898-14DC-46B6-919B-FCA513BA9082} - System32\Tasks\{63A47BC4-989C-42B1-87A6-BEACADDAEABA} => pcalua.exe -a "D:\fotografia\Nero 12 Platinum 12.0.020 + Patch + Key [EC]\Nero 12 Platinum 12.0.020 + Patch + Key [EC]\Patch + Key\Nero-12.0.02000_trial .exe" -d "D:\fotografia\Nero 12 Platinum 12.0.020 + Patch + Key [EC]\Nero 12 Platinum 12.0.020 + Patch + Key [EC]\Patch + Key" Task: C:\Windows\Tasks\0414bUpdateInfo.job => C:\ProgramData\Avg_Update_0414b\0414b_AVG-Secure-Search-Update.exe S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X] S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X] S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X] S3 NDSPCIIO; \??\C:\Windows\system32\DRIVERS\NDSPCIIO64.SYS [X] HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver" C:\temp C:\Program Files\Common Files\Lavasoft C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anki.lnk C:\Users\Aniut\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences C:\Users\Aniut\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\*localstorage* C:\Users\Aniut\AppData\Roaming\LavasoftStatistics Reg: reg delete HKCU\Software\Mozilla /f Reg: reg delete HKLM\SOFTWARE\Mozilla /f Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f EmptyTemp: ***************** Processes closed successfully. Error: (0) Failed to create a restore point. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully. HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => value deleted successfully. HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\Software\Microsoft\Windows\CurrentVersion\Run\\KiesAirMessage => value deleted successfully. HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AVG-Secure-Search-Update_0913b => value deleted successfully. HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA => value deleted successfully. "HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKU\S-1-5-21-4088076161-2145778700-1263544819-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => value deleted successfully. HKCR\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => Key not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B992F898-14DC-46B6-919B-FCA513BA9082}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B992F898-14DC-46B6-919B-FCA513BA9082}" => Key deleted successfully. C:\Windows\System32\Tasks\{63A47BC4-989C-42B1-87A6-BEACADDAEABA} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{63A47BC4-989C-42B1-87A6-BEACADDAEABA}" => Key deleted successfully. C:\Windows\Tasks\0414bUpdateInfo.job => Moved successfully. catchme => Service deleted successfully. ew_usbenumfilter => Service deleted successfully. huawei_cdcacm => Service deleted successfully. huawei_enumerator => Service deleted successfully. huawei_ext_ctrl => Service deleted successfully. huawei_wwanecm => Service deleted successfully. NDSPCIIO => Service deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart" => Key deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys" => Key deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart" => Key deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys" => Key deleted successfully. C:\temp => Moved successfully. "C:\Program Files\Common Files\Lavasoft" => File/Directory not found. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anki.lnk => Moved successfully. C:\Users\Aniut\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences => Moved successfully. C:\Users\Aniut\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\*localstorage* => Moved successfully. C:\Users\Aniut\AppData\Roaming\LavasoftStatistics => Moved successfully. ========= reg delete HKCU\Software\Mozilla /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Mozilla /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\MozillaPlugins /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f ========= BŁĄD: System nie znalazł w rejestrze określonego klucza albo wartości. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukończona pomyślnie. ========= End of Reg: ========= EmptyTemp: => Removed 363.2 MB temporary data. The system needed a reboot. ==== End of Fixlog 14:33:00 ====